The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains an indirect prompt injection surface (Category 8) because it ingests and displays untrusted file and directory names from external Quark Cloud Drive shared links.
Ingestion points: Metadata is retrieved via Quark's API in quark_hub.py (via api_list_all and get_share_detail) and scripts/quark_share_ls.py (via detail).
Boundary markers: There are no explicit delimiters or instructions to the agent to ignore potential commands embedded in the file names.
Capability inventory: The skill has the ability to write files to the local system, execute shell commands, and perform network requests to external APIs.
Sanitization: File names from external sources are printed directly to the console without sanitization, allowing a malicious actor to potentially influence agent behavior through crafted file names in a shared folder.
[DATA_EXFILTRATION]: The skill accesses a sensitive local file path ~/.quark_hub_cookie to persist authentication tokens.
Evidence: The file is referenced in quark_hub.py and managed by scripts/refresh_cookie.sh. The skill follows security best practices by setting file permissions to 600 and implementing custom exception handling to prevent leaking the cookie in stack traces.
[COMMAND_EXECUTION]: The skill executes shell scripts and platform-specific CLI tools to manage the login flow.
Evidence: The scripts/refresh_cookie.sh script executes the minis-browser-use command and dynamically sources an environment file from /var/minis/offloads/ based on a regular expression match to extract session headers.

quark-hub